dotnet-clean-code

A set of C# and .NET coding standards covering names, language patterns, asynchronous programming, dependency injection, and tool usage. Dependency injection means supplying a class with the services it needs instead of creating them directly.

In plain words
What is it for?
Use it when writing or reviewing C# files, project files, or solution files, especially for naming members, designing async methods, injecting services, and following .NET conventions.
Why use it?
It gives .NET projects consistent rules for writing and organising code. It also helps prevent common mistakes in asynchronous code, service construction, and naming.

Cursor rule

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/adonai-labs/agent-runway/dotnet-clean-code
Clone the repo
git clone --depth 1 https://github.com/adonai-labs/agent-runway
Per session 0 Nothing until a file matches its globs; then the whole rule loads.
When invoked 1,285 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.01285
Opus 5 $0.00000 $0.00642
Sonnet 5 $0.00000 $0.00257
Haiku 4.5 $0.00000 $0.00128

Measured 2d ago against content hash c8189e989f99, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

dotnet-clean-code scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

src/stacks/dotnet/dotnet-clean-code.mdc · 165 lines

How it starts

The opening of the file, as written. The whole thing — 165 lines — stays where its author put it; the contents beside it link to each section on GitHub.

.NET Clean Code Standards

C#-specific coding standards. For universal principles (naming intent, SRP, DRY, error handling), see engineering-principles.mdc.

Conflict resolution: Where this file provides C#-specific guidance that differs from engineering-principles.mdc, this file takes precedence for .cs, .csproj, and .sln files. The universal rule provides the default; this rule provides the override.


C# naming conventions

  • PascalCase: types, methods, properties, constants, public fields
  • camelCase: parameters, local variables, private fields (with _ prefix for instance fields)
  • I prefix for interfaces: IOrderRepository, not OrderRepository
  • Async methods end in Async: GetOrderAsync, SaveChangesAsync
  • Boolean properties: IsActive, HasPermission, CanRetry
  • Event delegates end in EventHandler; events use past tense: OrderPlaced, PaymentFailed

Dependency injection

Always inject via constructor; do not use new directly for services.

// Correct
public class OrderService(IOrderRepository repository, ILogger<OrderService> logger) { }

// Incorrect
public class OrderService
{
    private readonly OrderRepository _repository = new OrderRepository();
}
  • Use constructor injection; avoid property injection except in framework-controlled types
  • Keep constructors lean; inject only what the class needs
  • Do not call services inside constructors; defer to method bodies

Async/await correctness

// Correct: async all the way, CancellationToken passed through
public async Task<Order> GetOrderAsync(Guid id, CancellationToken ct)
    => await _repository.GetByIdAsync(id, ct);

// Incorrect: blocking async call — causes deadlocks
var order = GetOrderAsync(id).Result;
  • Always await async calls; never use .Result or .Wait()
  • Accept CancellationToken in all public async methods and pass it downstream
  • Never use async void except for event handlers; always async Task
  • Use ConfigureAwait(false) in library code; not required in ASP.NET Core application code

Read the full file on GitHub · 165 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 165 lines · 1,285 tokens per session scan A c8189e989f99

Subscribe to this mod's changes

dotnet-clean-code is a cursor rule published in the GitHub repository adonai-labs/agent-runway (2 stars, last pushed 12d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,285 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.